CIPP/E PRACTICE QUESTIONS WITH
CORRECT ANSWERS
1. Which statement is correct when considering the right to privacy under article 8 of
the European Convention on Human Rights? - ANSWER-The right to privacy has to
be balanced against other rights under the ECHR
2. What is the one major goal that the OECD Guidelinges, Convention 108, and the
Directive all had in common but largely failed to achieve in Europe? - ANSWER-
The restriction of cross-border data flow
3. Which EU institution is vested with the competence to propose new data protection
legislation on its own initiative? - ANSWER-Commission
4. Which institution has the power to adopt findings that confirm the adequacy of the
data protection level in a non-EU country? - ANSWER-European Commission
5. What type of data lies beyond the scope of the GDPR? - ANSWER-Anonymised
6. What is the consequence if a processor makes an independent decision regarding
the purposes and means of processing it carries out on behalf of a controller? -
ANSWER-The processor will be considered to be a controller
7. With the issue of consent, the GDPR allows member states some choice regarding
what? - ANSWER-The age which children must be required to obtain parental
consent
,8. Which sentence BEST summarizes the concepts of Fairness, lawfullness, and
transparency, as expressly required by Article 5 of the GDPR? - ANSWER-Fairness
and transparency refer to the communication of key information before collecting
data; lawfulness refers to compliance with government regulations
9. Assuming that the "without undue delay" provison is followed, what is the time
limit for complying with a data access request? - ANSWER-1 month + additional 2
months
10. Company X has entrusted the processing of their payroll data provider to Y. Provider
Y stores this encrypted data on its server. The IT department of Provider Y finds out
that someone managed to hack into the system and take a copy of the data from its
server. In this scenario, whom does Provider Y have the obligation to notify? -
ANSWER-Company X
11. Which of the following would require designationg a data protection officer? -
ANSWER-The core activites of the controller or processor consist of processing
operations that require systematic monitoring of data subjects on a large scale.
(public authority or large scal sensitive data would apply as well)
12. When is a data sharing agreement MOST likely to be needed? - ANSWER-When
personal data is being shared between commercial orgs acting as joint data
controllers
13. An employee of company X has just noticed a memory stick containing records of
client data, including their names, addresses and full contact details has
disappeared. The data on the stick is unencrypted and in clear text. It is uncertain
what has happened to the stick as this stage, but it likely was lost during the travel
of an employee. What should the company do? - ANSWER-Notify as soon as
possible the data protection supervisory authority that a data breach may have taken
place
, 14. The GDPR specifies fines that may be levied against data controllers for certain
infringements. Which of the following infringements would be subject to the less
severe administrative fine of up to 10 million Euros? - ANSWER-Failure to
implement technical and organisational measures to ensure data protection is
enshrined by design and default
15. Why is it advisable to avoid consent as a legal basis for an employer to process
employee data? - ANSWER-Consent may not be valid if the employee feels
compelled to provide it
16. What is true about an employee who makes an access request to his employer for
any personal data held about him? - ANSWER-The employer must supply all the
information held about the employee unless there is an exemption
17. Discover which employees are accessing cloud services and from which devices and
apps
18. Lock down the data in those apps and devices
19. Monitor and analyse the apps and devices for compliance
20. Manage application life cycles
21. Monitor data sharing
22. An organisation should perform these steps to do which of the following? -
ANSWER-Maintain a secure BYOD program
23. If a company is planning to use CCTV on its premises and is concerned with GDPR
compliance, it should first do all of the following EXCEPT? - ANSWER-Notify the
appropriate data protection authority
24. In which of the following cases would an organisation MOST LIKELY be required
to follow both ePrivacy and data protection rules? - ANSWER-When calling a
potential customer to notify her of an upcoming product sale
CORRECT ANSWERS
1. Which statement is correct when considering the right to privacy under article 8 of
the European Convention on Human Rights? - ANSWER-The right to privacy has to
be balanced against other rights under the ECHR
2. What is the one major goal that the OECD Guidelinges, Convention 108, and the
Directive all had in common but largely failed to achieve in Europe? - ANSWER-
The restriction of cross-border data flow
3. Which EU institution is vested with the competence to propose new data protection
legislation on its own initiative? - ANSWER-Commission
4. Which institution has the power to adopt findings that confirm the adequacy of the
data protection level in a non-EU country? - ANSWER-European Commission
5. What type of data lies beyond the scope of the GDPR? - ANSWER-Anonymised
6. What is the consequence if a processor makes an independent decision regarding
the purposes and means of processing it carries out on behalf of a controller? -
ANSWER-The processor will be considered to be a controller
7. With the issue of consent, the GDPR allows member states some choice regarding
what? - ANSWER-The age which children must be required to obtain parental
consent
,8. Which sentence BEST summarizes the concepts of Fairness, lawfullness, and
transparency, as expressly required by Article 5 of the GDPR? - ANSWER-Fairness
and transparency refer to the communication of key information before collecting
data; lawfulness refers to compliance with government regulations
9. Assuming that the "without undue delay" provison is followed, what is the time
limit for complying with a data access request? - ANSWER-1 month + additional 2
months
10. Company X has entrusted the processing of their payroll data provider to Y. Provider
Y stores this encrypted data on its server. The IT department of Provider Y finds out
that someone managed to hack into the system and take a copy of the data from its
server. In this scenario, whom does Provider Y have the obligation to notify? -
ANSWER-Company X
11. Which of the following would require designationg a data protection officer? -
ANSWER-The core activites of the controller or processor consist of processing
operations that require systematic monitoring of data subjects on a large scale.
(public authority or large scal sensitive data would apply as well)
12. When is a data sharing agreement MOST likely to be needed? - ANSWER-When
personal data is being shared between commercial orgs acting as joint data
controllers
13. An employee of company X has just noticed a memory stick containing records of
client data, including their names, addresses and full contact details has
disappeared. The data on the stick is unencrypted and in clear text. It is uncertain
what has happened to the stick as this stage, but it likely was lost during the travel
of an employee. What should the company do? - ANSWER-Notify as soon as
possible the data protection supervisory authority that a data breach may have taken
place
, 14. The GDPR specifies fines that may be levied against data controllers for certain
infringements. Which of the following infringements would be subject to the less
severe administrative fine of up to 10 million Euros? - ANSWER-Failure to
implement technical and organisational measures to ensure data protection is
enshrined by design and default
15. Why is it advisable to avoid consent as a legal basis for an employer to process
employee data? - ANSWER-Consent may not be valid if the employee feels
compelled to provide it
16. What is true about an employee who makes an access request to his employer for
any personal data held about him? - ANSWER-The employer must supply all the
information held about the employee unless there is an exemption
17. Discover which employees are accessing cloud services and from which devices and
apps
18. Lock down the data in those apps and devices
19. Monitor and analyse the apps and devices for compliance
20. Manage application life cycles
21. Monitor data sharing
22. An organisation should perform these steps to do which of the following? -
ANSWER-Maintain a secure BYOD program
23. If a company is planning to use CCTV on its premises and is concerned with GDPR
compliance, it should first do all of the following EXCEPT? - ANSWER-Notify the
appropriate data protection authority
24. In which of the following cases would an organisation MOST LIKELY be required
to follow both ePrivacy and data protection rules? - ANSWER-When calling a
potential customer to notify her of an upcoming product sale
